@codetreker/daynight 0.21.9 → 0.21.13

package/README.md

@@ -2,8 +2,9 @@
 
 The `@codetreker/daynight` package provides the `daynight` command and its `dn`
 alias. Use it to manage server-backed projects, tasks and attachments, install
-the `using-daynight` skill for coding agents, and run a local GitHub PR reviewer
-through Copilot CLI. Both command names share configuration and behavior.
+the `using-daynight` skill for coding agents, run foreground task workers through
+Herdr, and run a local GitHub PR reviewer through Copilot CLI. Both command names
+share configuration and behavior.
 
 See the [project overview](../../README.md) for the browser workspace and service,
 and the [development guide](../../docs/development.md) for source builds,
@@ -20,6 +21,8 @@ GitHub CLI and Copilot CLI on `PATH`.
 - [Task management](#task-management)
 - [Task deletion](#task-deletion)
 - [Task attachments](#task-attachments)
+- [Worker configuration and startup](#worker-configuration-and-startup)
+- [Worker manual management](#worker-manual-management)
 - [Review configuration and startup](#review-configuration-and-startup)
 - [Review status listing](#review-status-listing)
 - [Durable review state](#durable-review-state)
@@ -78,11 +81,11 @@ its agents, scope, path and package version. A skill failure exits nonzero and
 reports the package outcome separately; a successfully installed npm package is
 retained, and rerunning `update` retries the skill refresh. All phases must
 succeed before the command reports success. It requires no review configuration and does
-not open SQLite, modify sessions or restart a running reviewer. The next CLI
-invocation uses the installed version. Restart any running reviewer to use it;
-on Windows, a reviewer holding a native addon open can prevent npm from replacing
+not open SQLite, modify sessions or restart a running reviewer or worker. The next CLI
+invocation uses the installed version. Restart any running reviewer or worker to use it;
+on Windows, a reviewer or worker holding a native addon open can prevent npm from replacing
 that file and cause the update to fail. The
-[self-update decision](../../.agents/notes/implemented/feature/2026-10-20-cli-self-update.md)
+[self-update decision](../../.agents/notes/archived/feature/2026-10-20-cli-self-update.md)
 records installation ownership and verification requirements.
 
 ## Client commands
@@ -94,6 +97,12 @@ daynight --version                   # Also -v
 daynight update
 daynight login [--no-browser]         # Authorize CLI access through the browser
 daynight logout                      # Revoke and remove the current CLI credential
+daynight worker                     # Show worker help
+daynight worker run                 # Run until interrupted
+daynight worker retry <task-id> --claim-id <claim-id> [--project <project-id>]
+daynight worker release <task-id> --claim-id <claim-id> --if-version <version> [--project <project-id>]
+daynight worker resume <task-id> --claim-id <previous-claim-id> --if-version <version> [--project <project-id>]
+daynight worker transfer <task-id> --claim-id <claim-id> --if-version <version> [target options] [--project <project-id>]
 daynight review                     # Show review help
 daynight review run
 daynight review list                 # Also review ls
@@ -132,7 +141,7 @@ Unknown commands and invalid arguments exit with status 2; operation failures
 exit with status 1 and retain their cause. The old `--daemon-review` and root
 `add-repo` forms are invalid. The
 [client design](../../docs/design/daynight.md) owns command composition and lazy loading;
-the [composition decision](../../.agents/notes/implemented/architecture/2026-10-20-client-command-composition.md)
+the [composition decision](../../.agents/notes/archived/architecture/2026-10-20-client-command-composition.md)
 records module ownership and the preserved data layout.
 
 ## Agent skill installation
@@ -144,7 +153,8 @@ prompt explicitly names the `worker-managed` environment, the `using-daynight`
 skill and that mode, together with their assignment. `SKILL.md` routes to the
 selected instructions; ordinary execution does not load managed task rules.
 Shared task inputs, delivery and acceptance rules retain one owner in the bundle.
-The worker runtime remains under development.
+The [foreground worker](#worker-configuration-and-startup) constructs that
+explicit assignment and loads the installed managed entry before launch.
 
 Install the skill through an interactive terminal:
 
@@ -293,9 +303,9 @@ update, run the applicable `source` command again to refresh an existing shell.
 A saved generated script must be regenerated after updating. The
 [completion design](../../docs/design/daynight-completion.md) explains the shared grammar
 and shell integration. The
-[completion decision](../../.agents/notes/implemented/feature/2026-10-20-shell-completion.md)
+[completion decision](../../.agents/notes/archived/feature/2026-10-20-shell-completion.md)
 records compatibility and execution trade-offs; the
-[setup decision](../../.agents/notes/implemented/feature/2026-10-21-completion-setup.md)
+[setup decision](../../.agents/notes/archived/feature/2026-10-21-completion-setup.md)
 records startup-file ownership and installation limits.
 
 ## Configuration setup
@@ -382,8 +392,8 @@ business execution. Human input consumes no business timeout. Review guidance
 saves configuration without network, login or authentication checks; cloning and
 review state initialization belong to the business operation.
 
-The [configuration decision](../../.agents/notes/implemented/feature/2026-10-21-guided-configuration-setup.md)
-owns review guidance and persistence; the
+The [configuration decision](../../.agents/notes/archived/feature/2026-10-21-guided-configuration-setup.md)
+records the review-guidance and persistence choices; the
 [device-login decision](../../.agents/notes/implemented/architecture/2026-10-25-cli-device-login.md)
 owns the default service, explicit login/logout and credential lifecycle. The
 [top-level setup removal decision](../../.agents/notes/implemented/simplification/2026-10-25-remove-top-level-setup.md)
@@ -744,9 +754,329 @@ known issue and the trusted same-origin preview model. The
 [authentication architecture](../../docs/design/daynight-auth.md) defines the required
 authentication and project-membership checks for attachment requests. Trusted
 executable HTML retains the application origin. The
-[CLI delivery decision](../../.agents/notes/implemented/feature/2026-10-21-task-attachment-cli.md)
+[CLI delivery decision](../../.agents/notes/archived/feature/2026-10-21-task-attachment-cli.md)
 records binary transport and output ownership.
 
+## Worker configuration and startup
+
+`daynight worker run` is a foreground process that claims eligible ready tasks
+across configured repositories and runs Copilot or Codex in a dedicated Herdr
+instance. The agent owns task delivery, acceptance, evidence and final
+claim-bound completion. The worker owns concurrency, resources, recovery and
+cleanup based on its current claim inventory.
+
+Install Git, Herdr 0.9.5 or newer with protocol 22 capabilities, and the selected
+native agent on PATH. Native/provider authentication and the current official
+Herdr SessionStart integration must be configured explicitly. Codex needs the
+hooks feature and `--no-daemon`; Unix hook scripts need bash and python3, while
+Windows hooks need PowerShell. The worker reports missing capabilities or
+integration/history instead of installing or changing global native settings.
+Git transport and tools used by the task, such as authenticated GitHub CLI for
+PR delivery, must also be ready.
+
+Run `daynight login` for Daynight authentication. Add the following mapping to
+the shared `~/.daynight/config.yml`, preserving existing connection and review
+settings:
+
+```yaml
+worker:
+  maxConcurrent: 1
+  pollIntervalMs: 5000
+  recoveryLimit: 3
+  agent: copilot
+  model: null
+  args: []
+  repositories:
+    - remote: https://github.com/OWNER/REPO.git
+      path: ../code/repo
+    - remote: https://github.com/OWNER/OTHER.git
+      path: ../code/other
+      agent: codex
+      model: null
+      args: []
+```
+
+These are the defaults for all optional worker fields; `repositories` is
+required. Each entry requires `remote` and `path`, with optional `projectId`,
+`agent`, `model` and `args`. The service project must already exist and match the
+repository. Add `projectId` when more than one project matches. Missing local
+repositories are cloned; existing roots and origins are verified without
+resetting their files or branches. Use the native authentication configuration
+for credentials, keeping credentials out of repository URLs and argument lists.
+
+Paths are absolute or relative to the configuration file's directory, never
+the launch directory. Tilde expansion and drive-relative Windows paths are
+rejected. Repository identities, project IDs and paths cannot duplicate or
+overlap, including the fixed Daynight state directory. Unknown worker fields,
+wrong types, invalid arguments and unsupported path shapes fail visibly.
+`maxConcurrent` is a positive integer, `recoveryLimit` is nonnegative and
+`pollIntervalMs` is a positive safe integer within the timer range.
+
+Repository agent settings override fields independently when the type stays
+the same; explicit null model or an empty args list clears that field. Switching
+agent type clears inherited model and arguments unless the repository explicitly
+sets them. Args replace the list rather than append. The recovery limit is
+worker-wide. Configuration loads at startup, without hot reload; existing claims
+keep their original frozen configuration after a restart, while later claims
+use the newly loaded settings.
+
+New tasks have automatic execution disabled. Enable it explicitly with the
+normal task update workflow after reading the current task/version. The worker
+selects only ready, permitted tasks compatible with its actual platform; WSL
+counts as Linux. It never enables that permission itself. Released tasks wait
+for explicit management and do not immediately re-enter ordinary automatic
+acquisition. Run the worker with:
+
+```bash
+daynight worker run
+```
+
+The command generates and atomically saves a stable root `workerId` on first
+use. One foreground instance owns fixed `~/.daynight/worker/` state: its SQLite,
+instance lock, logs, temporary resources and private Herdr data. There is no
+state-path override. Each task uses `daynight/<task-id>` and
+`<repository>/.worktrees/daynight/<task-id>`. The same valid claim retains dirty
+work, native history and configuration; a new claim has a fresh execution
+identity and conversation.
+
+The worker verifies the startup credential through the existing current-user
+API and pins successful response identity, including empty pages. Each local
+claim retains its original Daynight user ID. If another account is logged in on
+the same OS account, the stable workerId stays the same, but that account's empty
+inventory cannot terminate or resume the previous account's work. Scope-paused
+records need the original account/identity inspected; do not remove local state
+or regenerate workerId to make the mismatch disappear. The running process
+keeps its startup credential; restart after an intended account change.
+
+Changing serverUrl also separates local responsibility from remote work. The
+worker queries and acquires only on its current service. Previously committed
+cleanup deadlines and normal shutdown cover that worker's local records across
+all original services, without calling an old API or asking the new service
+about old records. A newly granted current-service claim freezes its new
+configuration and waits pending behind any active predecessor with the same task UUID for that
+worker, including another origin. Read-only Git ownership attributes
+an occupied canonical path; it does not adopt the old conversation or config.
+
+The foreground stderr output and JSONL logs identify project/task/claim, platform,
+waiting, pause and cleanup errors. The log path is printed at startup. An
+unconfirmed claim request, native launch or input is retained for observation;
+it is not replayed. A pause still reserves capacity. Recovering missing original
+configuration, history or stop evidence requires inspection, without creating a
+replacement conversation to conceal the loss.
+
+For human input, copy the safe `attach` descriptor printed after the running
+worker has completed inventory and private managed-instance readiness.
+Invoke its `executable` with its `arguments` (`herdr --session w` for the default
+executable), apply exactly its `environment` overrides and remove the names in
+`unsetEnvironment` **only for that attach client process**. The descriptor's
+private XDG values select the worker's exact Herdr instance; the existing task
+pane keeps its original native XDG and private HISTFILE. The descriptor contains
+routing and native-home paths, not a dump of authentication values. Continue in
+the original task pane so the worker can observe the same execution.
+
+Native startup can be waiting at a folder-trust or authorization screen even
+when Herdr reports idle/interactiveReady. The worker checks the current Codex
+input surface before automatic text and Enter, reports a blocking reason and
+keeps the first prompt unsent. It does not choose native trust or change global
+trust configuration. Configure that prerequisite normally in the native tool or
+use the original attached task pane to make the decision explicitly, then leave
+the business composer available for input. This check does not inspect arbitrary
+human draft meaning or prove that a model consumed previously submitted text.
+
+The checked Codex startup/restart layout is the standard/default business
+composer together with a loaded model/reasoning and current-directory footer
+(`model-with-reasoning · current-dir`). Ask text or a version header alone is
+insufficient because provisional startup can show them too. A custom footer,
+cropped footer or otherwise unrecognized visible layout remains unknown; the
+original Operation bounds observation and ends not-submitted if that supported
+surface never appears. In the original session, finish any blocking decision
+and restore the supported standard native layout before requesting public retry.
+The worker does not change the layout, infer arbitrary draft meaning or turn
+this screen check into a native consumption receipt.
+
+For started executions, a successful complete own-claim inventory from the
+original account makes the original claim's absence cause
+the same terminal cleanup for done, release and transfer: request attributable
+outside-worktree cleanup for at most the original ten-minute deadline, confirm
+the original agent stopped, close its workspace, delete its worktree and retain
+local history. Failures keep responsibility and resume cleanup after restart.
+A failed, incomplete or differently scoped inventory cannot authorize a new
+terminal-cleanup decision. Already persisted cleanup/control intents continue in
+the same foreground process through a lightweight discovery loop and one
+transient asynchronous job per full claim, before current-user/project network
+requests and even during server read failures. Only already authorized intents
+with known original account scope advance; unknown-scope terminal/control
+intents remain preserved. Each job waits at most one second or its nearer
+original deadline, independently of pollIntervalMs. One task's held RPC does not
+postpone another task's next cleanup advance; per-task serialization still
+prevents overlapping operations on the same execution. There is no persisted job
+queue.
+
+Ctrl+C stops acquisition and ordinary input, cancels and joins the ordinary
+cleanup discovery loop and all per-claim jobs, then runs original-task shutdown
+with a separate bounded cancellation scope and a shared exit deadline.
+Unfinished claims, worktrees and native history remain; the private instance
+stops only after original agents are confirmed stopped. Stop uncertainty is
+reported and retains the instance/resources for inspection. Restart the command
+to reconcile with the same worker identity and original state. After consuming
+interrupted shutdown, the worker refreshes Herdr resources before ordinary
+execution. If a native launch may have occurred but its exact original session
+ID is missing, shutdown preserves its old binding, launch and PID evidence and
+pauses; it does not turn that execution into a first launch. Proven
+never-started work and executions with a known original native ID retain their
+normal recovery path.
+
+A causal worker cancellation propagates into shutdown without adding a fault
+pause. Existing real pauses, recovery budget and unknown-action records keep
+their meaning; an unrelated error is not normal cancellation merely because the
+signal is already aborted. Read-only interruption followed by successful
+shutdown can resume the original session through the normal recovery path.
+
+Pending successors whose resources, workspace and native launch are proven
+never started stay pending on normal exit. A successful complete inventory from
+the same original account can complete an absent unstarted claim directly,
+without activating it or touching an older claim's fixed Git path. Other tasks'
+shutdown initialization is isolated so one bad record does not prevent known
+agents stopping. Untracked resources or unknown scope keep the private instance
+when its stop cannot be confirmed.
+
+Linux, Windows and macOS complete Goal acceptance is separate from the installed
+runtime and its component checks. The
+[worker requirements](../../docs/spec/daynight-worker.md) and
+[worker design](../../docs/design/daynight-worker.md) own the behavior and
+mechanisms, including native capability limits.
+
+## Worker manual management
+
+Manual commands select one task and its exact original claim. They use the same
+fixed SQLite and singleton lock as `worker run`. With a foreground worker, that
+process remains the sole agent controller and consumes the persisted decision;
+without one, the command acquires the same lock and advances the same coordinator
+for that execution. There is no separate control service. Current configuration
+and Daynight authentication are required, and the original service origin must
+match. Release, transfer and retry require the unfinished original local record;
+resume can use an explicit project with its configured repository.
+
+Read the current task before deciding a versioned operation:
+
+```bash
+daynight task show <task-id> --json
+daynight worker release <task-id> --claim-id <source-claim-id> --if-version <version>
+```
+
+Release and transfer first verify project access and source owner/admin
+permission, then persist the concrete source decision before cleanup. The
+controller requests the original agent's attributable temporary-resource cleanup,
+waits for its original deadline of at most 10 minutes, confirms that agent stopped,
+closes its task workspace and deletes its worktree. Only then can it submit the
+remote write at the exact supplied version. Other tasks keep their shared Herdr
+instance. Failed stopping or deletion retains the source responsibility and a
+visible error. Cleanup keeps its original deadline after restart; each HTTP
+request has an independent bounded scope, without a five-minute total command
+limit.
+
+Release returns the task to `todo` and clears its execution interval. The daemon
+skips released tasks until explicitly resumed. Resume starts a fresh execution
+on this worker:
+
+```bash
+daynight worker resume <task-id> --claim-id <released-claim-id> --if-version <version> \
+  --project <project-id>
+```
+
+The previous claim must still be released and the task ready. The original owner
+or a current project admin may resume it, retaining the explicit manual exception
+to automatic permission and platform filters. The new claim and worktree IDs are
+generated and persisted before submission. Its actual grant commits local
+`pending` with this repository's current effective agent/model/args; `worker run`
+then performs ordinary capacity checks and prepares a fresh native conversation.
+The deleted source worktree and native history are not required. Run
+`daynight worker run` if the foreground worker is stopped.
+
+Transfer explicitly identifies the target's current user, stable worker and
+machine descriptor, actual platform and selected agent:
+
+```bash
+daynight worker transfer <task-id> --claim-id <source-claim-id> --if-version <version> \
+  --target-user-id <user-id> --target-worker-id <worker-id> \
+  --target-machine-id <machine-id> --target-machine-name "target-machine" \
+  --target-platform linux --target-agent codex
+```
+
+Use the intended receiver's actual descriptor and the explicitly selected new
+agent type. A trace-free new transfer grant honors that agent even when the
+receiver's current repository defaults select the other type. It freezes
+`model: null` and `args: []` for that type, with the current recovery limit; a
+matching type uses the current effective model/args. Existing pending snapshots
+are retained. The source operator's owner/admin permission is checked separately
+from the target's
+current membership. Transfer still requires automatic execution permission,
+platform compatibility and completed dependencies. It preserves `in_progress`
+and the task's execution interval, installing a fresh target claim/worktree ID
+with empty runtime associations. The receiver discovers its actual grant through
+normal claim inventory and starts a new execution; an old task path still in use
+blocks preparation. No source files, SQLite snapshots or native history are
+transported. Target and source agents may differ. Public commands provide no
+claim/worktree-ID override or continuity confirmation option; the service and
+typed client reject deprecated `continuityConfirmed` input.
+
+For a paused execution that still belongs to the original owner, authorize one
+extra recovery attempt:
+
+```bash
+daynight worker retry <task-id> --claim-id <claim-id>
+```
+
+Retry preserves the original claim, worktree/native identity and frozen
+settings, retaining the cumulative recovery count rather than resetting it.
+Concurrent or repeated requests do not accumulate extra authorization or launch
+a second agent. The controller consumes the single permit for that original
+execution; a further failure remains visible. Retry cannot replace terminal
+cleanup or recreate an execution that has ended.
+
+A native launch acknowledged before a blocking startup screen has a specific
+continuation path when its first prompt is durably known unsent. Keep the
+original worker/native session running and use another terminal to attach to
+that original pane. Inspect the reported folder-trust/authorization requirement
+and make the native decision yourself. Once the business composer is available,
+run:
+
+```bash
+daynight worker retry <task-id> --claim-id <original-claim-id> --project <project-id>
+```
+
+The controller first checks the original worktree, full binding, frozen argv,
+workspace/launch evidence, same shell and every saved native key PID. Ordinary
+child-process changes do not replace the original proof. After that read-only
+identity check, it consumes one authorized recovery attempt (the cumulative
+count increases by one, without reset) and can deliver the first prompt once in
+the original native process without another agent.start or conversation. Missing
+an official native ID before the first turn does not by itself block this
+proven-unsent continuation. This is not permission to resend an earlier
+submitted/unknown prompt, infer loss from an empty-looking composer or restart
+an unproven missing-ID conversation. Legacy records with unknown native-process
+role remain fenced; migration does not construct identity from foreground PID
+order. Automated cleanup text and /exit use the same screen boundary; a blocking
+screen is not accepted with Enter merely to finish shutdown.
+
+Management diagnostics identify the original claim and report persisted waiting,
+completion, rejection or unknown results. Interrupting the command retains its
+intent so the foreground controller or a later management invocation can
+continue. An unknown release/transfer write is reconciled by reading the actual
+task and saved target claim; it is never resent or assigned replacement IDs,
+even when a read still shows the old value. Reinvoking that same decision can
+reconcile its result by targeted reads, including beside a running foreground
+worker, without taking over resource control or resubmitting. An already-cleaned
+source is not restarted. Only a definitely rejected submission can be replaced by a new explicit
+decision, with the supplied `--if-version` matching a fresh task observation. The
+numeric version may remain the same when the refusal did not change the task,
+including a definite pre-dispatch failure or permission refusal. An unknown
+submission cannot be reset or replayed; `--if-version` is never silently replaced.
+Unknown resume requests likewise retain their original claim/worktree/config
+until the actual grant can be confirmed. These targeted reads reconcile manual
+writes; automatic cleanup still relies only on a complete successful inventory
+for the original authenticated user and worker.
+
 ## Review configuration and startup
 
 Register a repository explicitly, or let the first review operation guide registration:
@@ -843,7 +1173,7 @@ review preparation and execution. Startup acquires an exclusive instance lock,
 opens SQLite and prepares the configured clones. Each repository is polled
 independently; access failures retain its last complete observation and remain
 visible in diagnostics. The
-[repository registration decision](../../.agents/notes/implemented/feature/2026-10-18-add-repo-configuration.md)
+[repository registration decision](../../.agents/notes/archived/feature/2026-10-18-add-repo-configuration.md)
 records the fixed-path and configuration-only choices.
 
 ## Review status listing
@@ -890,7 +1220,7 @@ database, migrate a schema, recover interrupted work or update application state
 SQLite may create or update its WAL coordination sidecar files while reading an
 existing database. Missing or invalid configuration, unreadable or corrupt state,
 and unsupported schema versions fail visibly. The
-[listing decision](../../.agents/notes/implemented/feature/2026-10-18-review-status-listing.md)
+[listing decision](../../.agents/notes/archived/feature/2026-10-18-review-status-listing.md)
 records status attribution and snapshot limits.
 
 ## Durable review state
@@ -925,7 +1255,7 @@ Database state does not replace physical Git/worktree or session-history
 verification.
 
 See the [review architecture](../../docs/design/daynight-review.md) for transitions and the
-[state decision](../../.agents/notes/implemented/architecture/2026-10-17-durable-review-state.md)
+[state decision](../../.agents/notes/archived/architecture/2026-10-17-durable-review-state.md)
 for persistence choices. The coordinator opens this state before scheduling work
 and advances only the revision captured by each completed attempt.
 
@@ -941,7 +1271,7 @@ the previous repository observation. A completed pass commits its observations
 and success time atomically. Rate-limit failures expose the server's retry
 deadline and block later same-host calls in that client; the coordinator schedules
 the next pass after the applicable deadline.
-The [observation decision](../../.agents/notes/implemented/architecture/2026-10-17-github-observation.md)
+The [observation decision](../../.agents/notes/archived/architecture/2026-10-17-github-observation.md)
 records pagination and failure handling.
 
 CI admission uses a read-only GraphQL query for the current PR head and
@@ -978,11 +1308,13 @@ even when the base checkout uses sparse settings. Confirmation retries retain
 local context. Files, nested clones and administration inside the owned PR
 worktree are disposable; cleanup does not inventory their external consumers.
 Other PR worktrees and retained sessions remain separate. Cleanup rechecks remote
-closure before removal. The [exclusive-environment decision](../../.agents/notes/implemented/architecture/2026-10-17-exclusive-review-environment.md)
-defines this ownership boundary.
+closure before removal. The [exclusive-environment decision](../../.agents/notes/archived/architecture/2026-10-17-exclusive-review-environment.md)
+records the choice of this ownership boundary.
 
-See the [worktree ownership decision](../../.agents/notes/implemented/architecture/2026-10-17-owned-review-worktrees.md)
-for target validation and recovery boundaries.
+The [review architecture](../../docs/design/daynight-review.md#worktree-生命周期)
+defines target validation and recovery boundaries; the
+[worktree ownership decision](../../.agents/notes/archived/architecture/2026-10-17-owned-review-worktrees.md)
+records their rationale.
 
 ## Copilot execution
 
@@ -1102,17 +1434,17 @@ before completing the round. It owns scheduling and final state transitions;
 runtime process supervision supplies evidence under the foreground execution
 contract.
 
-The [execution decision](../../.agents/notes/implemented/architecture/2026-10-17-copilot-session-execution.md)
+The [execution decision](../../.agents/notes/archived/architecture/2026-10-17-copilot-session-execution.md)
 records process and publication boundaries; the
-[PR-quality decision](../../.agents/notes/implemented/process/2026-10-21-review-pr-quality-gates.md)
+[PR-quality decision](../../.agents/notes/archived/process/2026-10-21-review-pr-quality-gates.md)
 records the approval policy, and the
 [multi-perspective decision](../../.agents/notes/implemented/process/2026-10-22-pr-specific-review-perspectives.md)
 records delegation and synthesis. The
-[conversation-cycle decision](../../.agents/notes/implemented/architecture/2026-10-21-review-conversation-cycle.md)
+[conversation-cycle decision](../../.agents/notes/archived/architecture/2026-10-21-review-conversation-cycle.md)
 records durable follow-ups and publication verification. The
 [skill design](../../docs/design/daynight-review-skill.md) owns packaging, snapshots and
 loading, with rationale in the
-[bundled-skill decision](../../.agents/notes/implemented/architecture/2026-10-20-bundled-review-skill.md).
+[bundled-skill decision](../../.agents/notes/archived/architecture/2026-10-20-bundled-review-skill.md).
 Native probes with Copilot CLI 1.0.100 verify actual bundled-skill activation and
 changed-bundle resume with the same UUID, including comma, space and Unicode
 paths. The bundled-skill decision records the probe's conditions and limits.
@@ -1171,7 +1503,7 @@ and logs. That explicitly confirmed restart reconciles interrupted work with
 the same captured target and session; it never declares a saved running attempt
 complete or kills a saved process ID.
 
-The [coordination decision](../../.agents/notes/implemented/architecture/2026-10-17-foreground-review-coordination.md)
+The [coordination decision](../../.agents/notes/archived/architecture/2026-10-17-foreground-review-coordination.md)
 explains scheduling and the foreground execution boundary. The
-[stale-lock recovery decision](../../.agents/notes/implemented/bug-fix/2026-10-18-stale-instance-lock-recovery.md)
+[stale-lock recovery decision](../../.agents/notes/archived/bug-fix/2026-10-18-stale-instance-lock-recovery.md)
 records owner-liveness checks and the separate process-exclusion requirement.

package/dist/api/client.d.ts

@@ -1,5 +1,5 @@
 import type { Operation } from "./operation.js";
-import type { AttachmentConsumer, CreateProjectInput, CreateTaskInput, DeleteTaskInput, ErrorDetails, Project, PutTaskAttachmentInput, ReadyTaskFilters, ServerError, Task, SetTaskStatusInput, TaskAttachment, TaskFilters, TaskGraph, UpdateTaskInput, ClaimWorkerTaskInput, CompleteWorkerTaskInput, ReleaseWorkerClaimInput, ResumeWorkerTaskInput, TransferWorkerClaimInput, UpdateWorkerClaimInput, Page, TaskPageQuery } from "./types.js";
+import type { AttachmentConsumer, CreateProjectInput, CreateTaskInput, DeleteTaskInput, ErrorDetails, Project, ProjectMember, PutTaskAttachmentInput, ReadyTaskFilters, ServerError, Task, SetTaskStatusInput, TaskAttachment, TaskFilters, TaskGraph, UpdateTaskInput, ClaimWorkerTaskInput, CompleteWorkerTaskInput, ReleaseWorkerClaimInput, ResumeWorkerTaskInput, TransferWorkerClaimInput, UpdateWorkerClaimInput, User, Page, TaskPageQuery } from "./types.js";
 type Context = {
     readonly operation: string;
     readonly projectId?: string;
@@ -26,9 +26,11 @@ export declare class ApiError extends Error {
     });
 }
 export type ApiClient = {
+    getCurrentUser(): Promise<User>;
     createProject(input: CreateProjectInput): Promise<Project>;
     getProject(projectId: string): Promise<Project>;
     listProjects(): Promise<readonly Project[]>;
+    listProjectMembers(projectId: string): Promise<readonly ProjectMember[]>;
     createTask(projectId: string, input: CreateTaskInput): Promise<Task>;
     getTask(projectId: string, taskId: string): Promise<Task>;
     listTasks(projectId: string, filters?: TaskFilters): Promise<readonly Task[]>;
@@ -52,6 +54,7 @@ export type ApiClient = {
 export declare const createApiClient: (options: {
     readonly serverUrl: string;
     readonly serverToken?: string;
+    readonly expectedUserId?: string;
     readonly operation: Operation;
     readonly fetch?: typeof globalThis.fetch;
 }) => ApiClient;

package/dist/api/client.js

@@ -2,7 +2,7 @@ import { performance } from "node:perf_hooks";
 import { parseApiJson, stringifyApiJson } from "./json.js";
 import { OperationError } from "./operation.js";
 import { validateServerToken, validateTokenTransport } from "../config/server-token.js";
-import { canonicalId, parsePage, parseProject, parseServerError, parseTask, parseTaskGraph, parseTaskAttachment, ProtocolError, validateAttachmentPath } from "./parse.js";
+import { canonicalId, parsePage, parseProject, parseProjectMembers, parseServerError, parseTask, parseTaskGraph, parseTaskAttachment, parseUser, ProtocolError, validateAttachmentPath } from "./parse.js";
 export class ApiError extends Error {
     operation;
     phase;
@@ -55,6 +55,7 @@ export const createApiClient = (options) => {
     if (!/^https?:$/.test(origin.protocol) || origin.username !== "" || origin.password !== "" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "")
         throw new Error("serverUrl must be an HTTP(S) service origin without credentials, path, query or fragment.");
     const serverToken = options.serverToken === undefined ? undefined : validateServerToken(options.serverToken);
+    const expectedUserId = options.expectedUserId === undefined ? undefined : resourceId(options.expectedUserId);
     if (serverToken !== undefined)
         validateTokenTransport(origin.origin);
     const operation = options.operation;
@@ -166,6 +167,15 @@ export const createApiClient = (options) => {
                 reader = response.body.getReader();
                 // Cancelling an already errored stream repeats its existing failure, rather than introducing a cleanup failure.
                 void reader.closed.catch((error) => { bodyFailure = error; });
+            }
+            if (success && expectedUserId !== undefined) {
+                phase = "protocol";
+                const principal = response.headers.get("Daynight-User-ID");
+                if (principal === null || canonicalId(principal) !== expectedUserId)
+                    throw new ProtocolError("The authenticated response principal does not match the expected user.");
+                phase = "response";
+            }
+            if (reader !== undefined) {
                 while (true) {
                     checkRequest();
                     const chunk = await Promise.race([reader.read(), aborted]);
@@ -344,6 +354,8 @@ export const createApiClient = (options) => {
     const herdrMatches = (actual, expected) => actual === null || expected === null ? actual === expected : actual.session === expected.session && actual.workspaceId === expected.workspaceId && actual.paneId === expected.paneId;
     const descriptorMatches = (worker, descriptor) => worker.claimId === canonicalId(descriptor.claimId) && worker.workerId === canonicalId(descriptor.workerId) && worker.machine.id === canonicalId(descriptor.machine.id) && worker.machine.name === descriptor.machine.name && worker.platform === descriptor.platform && worker.agent === descriptor.agent && worker.worktreeId === canonicalId(descriptor.worktreeId);
     const workerMutation = (projectId, taskId, action, suffix, method, input, matches, sameValue = false) => {
+        if (Object.hasOwn(input, "continuityConfirmed"))
+            throw new Error("continuityConfirmed is no longer accepted. New executions require fresh claim and worktree IDs.");
         const project = resourceId(projectId), task = resourceId(taskId);
         taskVersion(input.version);
         return exchange({ operation: action, projectId: project, taskId: task }, `/projects/${encodeURIComponent(project)}/tasks/${encodeURIComponent(task)}${suffix}`, method, { kind: "json", parse: (value) => {
@@ -355,12 +367,17 @@ export const createApiClient = (options) => {
             } }, [200], { kind: "json", value: input }, true);
     };
     return {
+        getCurrentUser: () => exchange({ operation: "auth.me" }, "/me", "GET", { kind: "json", parse: parseUser }, [200], undefined, true),
         createProject: (input) => request({ operation: "project.create" }, "/projects", "POST", (value) => parseProject(value), { name: input.name, repoUrl: input.repoUrl }),
         getProject: (projectId) => {
             const project = resourceId(projectId);
             return request({ operation: "project.show", projectId: project }, `/projects/${encodeURIComponent(project)}`, "GET", (value) => parseProject(value, project));
         },
         listProjects: () => list({ operation: "project.list" }, "/projects", (value) => parseProject(value), (project) => project.id),
+        listProjectMembers: (projectId) => {
+            const project = resourceId(projectId);
+            return exchange({ operation: "project.members", projectId: project }, `/projects/${encodeURIComponent(project)}/members`, "GET", { kind: "json", parse: (value) => parseProjectMembers(value, project) }, [200], undefined, true);
+        },
         createTask: (projectId, input) => {
             const project = resourceId(projectId);
             writableProperties(input.properties);